linux/drivers/misc/cxl
Frederic Barrat ad7b4e8022 cxl: Fix possible deadlock when processing page faults from cxllib
cxllib_handle_fault() is called by an external driver when it needs to
have the host resolve page faults for a buffer. The buffer can cover
several pages and VMAs. The function iterates over all the pages used
by the buffer, based on the page size of the VMA.

To ensure some stability while processing the faults, the thread T1
grabs the mm->mmap_sem semaphore with read access (R1). However, when
processing a page fault for a single page, one of the underlying
functions, copro_handle_mm_fault(), also grabs the same semaphore with
read access (R2). So the thread T1 takes the semaphore twice.

If another thread T2 tries to access the semaphore in write mode W1
(say, because it wants to allocate memory and calls 'brk'), then that
thread T2 will have to wait because there's a reader (R1). If the
thread T1 is processing a new page at that time, it won't get an
automatic grant at R2, because there's now a writer thread
waiting (T2). And we have a deadlock.

The timeline is:
1. thread T1 owns the semaphore with read access R1
2. thread T2 requests write access W1 and waits
3. thread T1 requests read access R2 and waits

The fix is for the thread T1 to release the semaphore R1 once it got
the information it needs from the current VMA. The address space/VMAs
could evolve while T1 iterates over the full buffer, but in the
unlikely case where T1 misses a page, the external driver will raise a
new page fault when retrying the memory access.

Fixes: 3ced8d7300 ("cxl: Export library to support IBM XSL")
Cc: stable@vger.kernel.org # 4.13+
Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2018-04-04 22:09:33 +10:00
..
api.c the rest of drivers/*: annotate ->poll() instances 2017-11-28 11:06:58 -05:00
base.c cxl: Add support for interrupts on the Mellanox CX4 2016-07-14 20:27:08 +10:00
context.c cxl: Add support for ASB_Notify on POWER9 2018-01-19 23:19:37 +11:00
cxl.h cxl: read PHB indications from the device tree 2018-03-13 15:50:30 +11:00
cxllib.c cxl: Fix possible deadlock when processing page faults from cxllib 2018-04-04 22:09:33 +10:00
debugfs.c cxl: Rework the implementation of cxl_stop_trace_psl9() 2017-11-06 16:48:17 +11:00
fault.c cxl: Add support for POWER9 DD2 2017-10-06 20:52:43 +11:00
file.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
flash.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
guest.c cxl: Add psl9 specific code 2017-04-13 23:34:31 +10:00
hcalls.c cxl: Remove unused values in bare-metal environment. 2017-04-13 23:34:28 +10:00
hcalls.h cxl: Add guest-specific code 2016-03-09 23:36:52 +11:00
irq.c cxl: Add psl9 specific code 2017-04-13 23:34:31 +10:00
Kconfig cxl: Export library to support IBM XSL 2017-07-03 23:07:03 +10:00
main.c cxl: Fixes for Coherent Accelerator Interface Architecture 2.0 2017-06-23 16:26:23 +10:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
native.c cxl: Check if PSL data-cache is available before issue flush request 2018-03-13 15:50:26 +11:00
of.c cxl: replace loop with for_each_child_of_node(), remove unneeded of_node_put() 2016-10-04 16:19:23 +11:00
pci.c cxl: Fix timebase synchronization status on P9 2018-03-14 20:01:18 +11:00
phb.c cxl: Fix error handling in _cxl_pci_associate_default_context() 2016-11-18 22:41:08 +11:00
sysfs.c cxl: Fix timebase synchronization status on P9 2018-03-14 20:01:18 +11:00
trace.c cxl: Add tracepoints 2015-01-22 17:31:51 +11:00
trace.h cxl: Add psl9 specific code 2017-04-13 23:34:31 +10:00
vphb.c powerpc: rename dma_direct_ to dma_nommu_ 2018-01-10 16:41:14 +01:00